CVE-2026-103674 Details
Description
Invocation of the NetApp ONTAP special agent with the login password in the command line in Checkmk version 2.5.0 before 2.5.0p16 allows a local user on the Checkmk server to read the NetApp login password from the process list while the special agent is running. This affects both explicitly configured passwords and passwords from the password store.
A vulnerability in Checkmk versions 2.5.0 prior to 2.5.0p16 allows local users on the Checkmk server to read NetApp login passwords from the process list while the special agent is running. This issue affects both explicitly configured passwords and those stored in the password store. The vulnerability arises because the NetApp special agent receives passwords in plain text on the command line, where they can be accessed by anyone who can list processes on the server.
Users can upgrade to Checkmk version 2.5.0p16 or later, where this vulnerability has been addressed. Instructions for upgrading can be found in the Checkmk documentation.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://checkmk.com/werk/22429 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-214 | Invocation of Process Using Visible Sensitive Information | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Checkmk | 2.5.0 (semver) |
CPE
Remediation
| |
Change History
1 change record found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 6, 2026 | New CVE Received | [email protected] |